Xerte Online Toolkits CVE-2026-41459

The /setup page must be accessible and operational on the target instance. The root_path variable must be rendered in the HTML response of the /setup page without access controls or output sanitization. No authentication is required to trigger the vulnerability. The vulnerability applies to default configurations and installations of Xerte Online Toolkits versions 3.15 and earlier. The exposure is limited by network reachability to the web application and is contingent on the /setup page not being manually removed or disabled by administrators after installation.

While the CVSS v4.0 score of 6.9 reflects network accessibility (AV:N) and low complexity (AC:L) with no authentication requirements (PR:N), the actual real-world risk is moderate and primarily foundational. The vulnerability itself provides only confidentiality impact (VC:L) - disclosure of the filesystem root path - with no direct integrity or availability impact. However, the value of this information disclosure lies in its role as an enabler for secondary exploitation: attackers can use the exposed root path to craft more precise relative path traversal attacks against connector.php. The CVSS score appropriately reflects this indirect risk. Without the exposed path, relative path traversal attacks become harder to execute reliably. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been identified at the time of analysis. Vendor-released patch is available (commit f063e942b4a9bf77a06829e844c2c70316bc45e8), which should be prioritized for systems hosting sensitive learning content or operating in environments where path disclosure could facilitate reconnaissance.

An attacker performs network reconnaissance of a target Xerte Online Toolkits instance by sending an unauthenticated GET request to https://target.example.com/setup. The server responds with HTML containing the root_path value (e.g., /var/www/html/xerte/), which the attacker extracts via simple string matching or HTML parsing. The attacker then crafts a relative path traversal attack against connector.php using the known path structure to escape the intended directory and access sensitive files such as configuration files containing database credentials or user data.